Sencho CVE-2026-108522

Exploitation requires a Sencho instance (≤0.94.1) deployed WITHOUT a correctly configured trusted-proxy boundary - in vulnerable versions the login limiter honored client-supplied X-Forwarded-For unconditionally, so default/typical deployments are affected. The attacker only needs remote network reach to /api/auth/login and no authentication (CVSS PR:N). LIMITING FACTORS: the flaw itself only defeats the per-IP failed-attempt rate limiter; it does not directly grant access, so the attacker must still brute-force or guess valid credentials to actually authenticate. The fix mitigates by ignoring forwarding headers unless they originate from explicitly configured proxy CIDRs (SENCHO_TRUSTED_PROXY_CIDRS) and by adding a failed-attempt limit keyed to normalized account identity, so instances already fronted by a correctly trusted proxy and patched are not exposed.

This is a medium-severity authentication-control weakness, not a direct auth bypass. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability with uniformly LOW impact across all metrics (VC:L/VI:L/VA:L and subsequent SC:L/SI:L/SA:L), and E:P marks exploit maturity as Proof-of-Concept - consistent with the report that exploit code has been made public. No CISA KEV listing and no EPSS score were provided in the input, so there is no signal of widespread or automated real-world exploitation; absence of EPSS means probability of exploitation cannot be quantified here. The vendor statement clarifies the true nature: the login limiter trusted client-supplied X-Forwarded-For with no trusted-proxy boundary, so an attacker can rotate the apparent client address to defeat per-IP rate limiting - this facilitates credential brute-force/stuffing rather than granting authentication by itself. Net assessment: a legitimate but moderate issue (not a critical, directly-exploitable auth bypass). The CWE-287 'improper authentication' label and the 'Authentication Bypass' tag slightly overstate impact relative to the vendor's description of a rate-limiter evasion; defenders should read this as a brute-force protection bypass. Priority is elevated by public PoC availability but tempered by low impact scoring and the dependency on separately brute-forcing valid credentials.

A remote, unauthenticated attacker targets the /api/auth/login endpoint of an internet-reachable Sencho instance (≤0.94.1) that trusts forwarding headers by default. By rotating the X-Forwarded-For value on each request, the attacker makes every login attempt appear to originate from a different client IP, defeating the per-IP failed-attempt limiter and enabling unthrottled password brute-force or credential-stuffing against user accounts. Public proof-of-concept exploit code exists (published as a GitHub gist), lowering the barrier to reproduction.